Hi, I'm running Fedora Core 4 (Linux 2.6.11) with netfilter 1.30. I've setup apache 2.54 to run at port 80. Basically when downloading large files(or pages) from apache, the download stalls after the first few kilobytes or so. The configuration for the firewall in /etc/sysconfig/iptables is: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :RH-Firewall-1-INPUT - [0:0] -A INPUT -j RH-Firewall-1-INPUT -A FORWARD -j RH-Firewall-1-INPUT -A OUTPUT -j ACCEPT -A RH-Firewall-1-INPUT -i lo -j ACCEPT -A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT -A RH-Firewall-1-INPUT -p 50 -j ACCEPT -A RH-Firewall-1-INPUT -p 51 -j ACCEPT -A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-port-unreachable COMMIT The solution is to add set port 80 to allow INVALID packets: -A RH-Firewall-1-INPUT -m state --state NEW,ESTABLISHED,RELATED,INVALID -m tcp -p tcp --dport 80 -j ACCEPT But the question is, why are subsequent packets coming from the remote machine being identified as INVALID? Will allowing INVALID packets cause other problems? The Linux machine is actually behind another Cisco PIX firewall. Could the hardware firewall be translating the packets wrongly? Any ideas? Regards, Andrew
